# Google Workspace

Follow the steps documented below to integrate your Org and Google Workspace for Single Sign On (SSO).

Important

Only users with "Organization Admin" privileges can configure SSO in the Web Console.

---

## Step 1: Create IdP

- Login into the Web Console as an Organization Admin
- Click on System and Identity Providers
- Click on "New Identity Provider"
- Provide a name, select "Custom" from the "IdP Type" drop down
- Enter the "Domain" for which you would like to enable SSO

Important

Within an org, the domain of an IdP cannot be used for another IdP. A domain existing in an org can be used in multiple orgs (for one IdP in each org)

- Optionally, toggle "Encryption" if you wish to send/receive encrypted SAML assertions
- Provide a name for the "Group Attribute Name"
- Optionally, toggle "Include Authentication Context" if you wish to send/receive auth context information in assertion
- Click on Save & Continue

Important

Encrypting SAML assertions is optional because privacy is already provided at the transport layer using HTTPS. Encrypted assertions provide an additional layer of security on top ensuring that only the SP (Org) can decrypt the SAML assertion.

---

## Step 2: View SP Details

The IdP configuration wizard will display critical information that you need to copy/paste into your Google Workspace. Provide the following information to your Google Workspace administrator.

- Assertion Consumer Service (ACS) URL
- SP Entity ID
- Name ID Format

---

## Step 3: Create App in Google Workspace

- Login into your Google Workspace as an Administrator
- Select **Apps**

##

- Select **SAML apps** to create a new application

---

## Step 4: General Settings

- Select the **Add App** dropdown
- Select **Add custom SAML app**
- Provide an App Name for the Web Console
- Click "Add" button to add the application

- Download IdP metadata by selecting **DOWNLOAD METADATA** under Option 1: Download Idp metadata

---

## Step 5: Configure SAML

- Copy/Paste the Entity ID from Step 2
- Copy/Paste the ACS URL from Step 2 into the "Reply URL"
- Copy/Paste the ACS URL from Step 2 into the "Sign on URL"
- Set **Name ID** to **EMAIL**
- Then click on **CONTINUE**

- Click on **FINISH**

---

## Step 6: Create Group in Google Workspace

- In the Admin Console select **Groups**

- Enter a group name, this same group will need to be configured in the Console

- Select **CREATE GROUP**

---

## Step 7: Assign User to Group in Google Workspace

- In the Admin Console select **Users**

- Select **Add to groups**

- Add the user to the group created in Step 6

---

## Step 8: Enable SSO in Google Workspace

- Go to **Apps -> Web and mobile apps -> Rafay Systems SSO -> Service Status** and set Service status to **ON for everyone**
- Optionally you can enable for **rafay-org-admins** by selecting groups and enter **rafay-org-admins**.

---

## Step 9: Configure SSO Attribute Mapping for SSO SAML Configuration

The SSO Attribute Mapping configuration step for Groups is critical because it will ensure that Google Workspace will send the groups the user belongs to as part of the SSO process. The group information is used to transparently map users to the correct group/role. In the illustrative example below, we are using **Rafay** as the name of the group attribute statement.

- Go to **Users -> More** and select **Manage custom attibutes**
- Select **ADD CUSTOM ATTRIBUTE** and enter a Category. The name should be the **Group Attribute Statement Name** we set in Step 1
- Set type to **Text**, Visibility to **Visible to User and admin**, and No. of values to **Single Value**

- Go to **Apps -> Web and mobile apps -> Rafay Systems SSO -> SAML Attribute mapping** and select **Configure SAML attribue mapping**
- Select **ADD MAPPING** and set the Google Directory attributes to the custom field we created earlier and set the App attributes to the **Group Attribute Name** we created in Step 1

---

## Step 10: Add Group Name to user in Google googleworkspace

- Go to **User Information** for the desired user account and edit the attribute we set in Step 9
- Set the value to the group name

---

## Step 11: Specify IdP Metadata File

- Navigate back to the Web Console's IdP Metadata Configuration page
- Select IdP Metadata File and upload the file downloaded in Step 4
- SAVE the IdP Settings

---

## Step 12: Create group in Console

An identical named group needs to be created as was created in Step 6. Ensure that this group is mapped to the appropriate Projects with the correct privileges. In the example below, the Group **rafay-org-admins** is configured as an "Organization Admin" with access to all Projects.

- Create a new group in the Console and select **CREATE**

---

## Recap

Congratulations! You have successfully enabled SSO using Google Workspace. You should be able to login to the Web Console using your Google Workspace credentials.

---